From patchwork Sun Jan 27 22:42:48 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Cyril Roelandt X-Patchwork-Id: 216078 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 4699C2C0092 for ; Mon, 28 Jan 2013 09:54:23 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756880Ab3A0Wxu (ORCPT ); Sun, 27 Jan 2013 17:53:50 -0500 Received: from mail-we0-f173.google.com ([74.125.82.173]:38156 "EHLO mail-we0-f173.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756840Ab3A0Wxn (ORCPT ); Sun, 27 Jan 2013 17:53:43 -0500 Received: by mail-we0-f173.google.com with SMTP id r5so1121662wey.32 for ; Sun, 27 Jan 2013 14:53:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:from:to:cc:subject:date:message-id:x-mailer; bh=XHzsfYeEu4srBUkuHDOISLhxb/hCC45/oxqmdhwbBXI=; b=u4Mn1jXHE2ZJG0gGFwvVl4jIpZ/Bifh+TqMSw36RdQ7f+Pdq8XnopDGklhjQP2yvG+ m/csOpEUHi0pj5yezCfa/85xOJu/5o402kNDAwb5990dZ6fsb0bbGLd6oABY4Z2wlDbr q0QY6hNODZTSD4tCPhd82Wy3ic/Gg5iGUGuZrt6gH3EYufNwTfhwmGqRMjklDtx3ymEK 75+XOiEgRI4IL5I8eYLhpXeida6cXQRZ3C/i7et14GZK2fuXe/jbrHIM76R/sLou8iGO SikKl/7//31Qh+bC9ZFGWnqTUpBS9dXJeEpggnpcKhhDci1CsOVxPJv5mFB745T1kKVM LRrg== X-Received: by 10.180.81.39 with SMTP id w7mr6675370wix.15.1359327221713; Sun, 27 Jan 2013 14:53:41 -0800 (PST) Received: from localhost.localdomain (tal33-3-82-233-82-24.fbx.proxad.net. [82.233.82.24]) by mx.google.com with ESMTPS id hb9sm9501842wib.3.2013.01.27.14.53.38 (version=TLSv1.2 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sun, 27 Jan 2013 14:53:40 -0800 (PST) From: Cyril Roelandt To: bzhao@marvell.com, linville@tuxdriver.com Cc: linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org, Cyril Roelandt Subject: [PATCH] mwifiex: avoid out of bounds access in mwifiex_get_common_rates. Date: Sun, 27 Jan 2013 23:42:48 +0100 Message-Id: <1359326568-17022-1-git-send-email-tipecaml@gmail.com> X-Mailer: git-send-email 1.7.10.4 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Check that the array indexes are in-bounds before accessing the rate2 and tmp arrays. Found with the following semantic patch: @@ identifier t; identifier idx; expression E; statement S; @@ * for (... ; <+... t[idx] ...+> && idx < E ; ...) S Signed-off-by: Cyril Roelandt Acked-by: Bing Zhao --- drivers/net/wireless/mwifiex/join.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c index 893d809..f0a634d 100644 --- a/drivers/net/wireless/mwifiex/join.c +++ b/drivers/net/wireless/mwifiex/join.c @@ -157,8 +157,8 @@ static int mwifiex_get_common_rates(struct mwifiex_private *priv, u8 *rate1, memset(rate1, 0, rate1_size); - for (i = 0; rate2[i] && i < rate2_size; i++) { - for (j = 0; tmp[j] && j < rate1_size; j++) { + for (i = 0; i < rate2_size && rate2[i]; i++) { + for (j = 0; j < rate1_size && tmp[j]; j++) { /* Check common rate, excluding the bit for basic rate */ if ((rate2[i] & 0x7F) == (tmp[j] & 0x7F)) {